WP Mobile Menu EUVD-2026-89620

Exploitation requires the WP Mobile Menu plugin (versions 2.7.4 up to before 2.9) to be installed and active, and critically depends on tricking an authenticated administrator into triggering the forged settings-import request during a live session (UI:R) - the attacker needs no plugin account of their own (PR:N). The limiting factors are significant: success hinges on social-engineering a privileged, logged-in admin to load attacker-controlled content, so it cannot be automated against arbitrary targets, and it is defeated by an admin who is not authenticated or who does not interact with the malicious page. The resulting stored payload then affects all site visitors, but the initial injection is gated entirely by admin interaction.

This is a moderate, real-but-not-urgent issue. The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is elevated primarily by the scope change (S:C) inherent to stored XSS that executes in every visitor's browser, plus PR:N because the attacker themselves need no plugin credentials. However, the score is meaningfully tempered by UI:R - the attack is a CSRF that only succeeds if a logged-in administrator is tricked into loading the attacker's request during an active session. All corroborating exploitation signals point LOW: SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the partial (C:L/I:L/A:L) impacts rather than full compromise. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept referenced in the input. The signals are internally consistent - no CVSS-versus-description conflict - so this reads as a genuine but low-real-risk stored XSS whose practical exploitation depends on social-engineering a privileged victim, not as a widely-weaponized threat.

An attacker crafts a malicious web page containing a forged settings-import request for WP Mobile Menu and lures a logged-in WordPress administrator into visiting it. Because the plugin fails to verify the nonce, the administrator's session silently imports attacker-chosen settings whose values are later emitted unescaped to every site visitor, planting a persistent stored XSS payload. No public exploit code is identified at time of analysis.